Identity verification is a real fraud-prevention step used by the IRS and state tax agencies. It is also a favorite story used by scammers. Both may mention a delayed refund and ask you to act, so the safe response is not to ignore every request—it is to verify the request through a channel you found independently.
Never sign in through an unexpected text or email. Open the known government website yourself or call the number listed on that agency’s official website. Our state pages take you to the responsible tax agency without collecting your information.
Why a legitimate agency may verify your identity
Tax-refund fraud occurs when someone files a return using another person’s Social Security number or ITIN. Automated systems look for patterns that may indicate a fraudulent or duplicate return. A legitimate taxpayer can be selected even when nothing is wrong.
Processing may stop until the agency confirms two things: that you are the person named on the return and that you actually filed it. The request can feel intrusive because those are precisely the details a criminal wants, which makes the method you use to respond crucial.
The IRS verification service says it should be used only after receiving a specified IRS notice. It asks taxpayers to have the notice and the relevant return available. After successful verification, the IRS advises waiting two to three weeks before checking the refund and says processing can take up to nine weeks. State timeframes differ.
Warning signs of a refund phishing message
The Federal Trade Commission warned in January 2026 about messages claiming that the IRS or a state tax office has approved a refund and asking the recipient to click a link to “verify” information. The FTC says real tax agencies do not use unsolicited texts, emails or social-media messages to collect personal refund information.
Treat these signs as suspicious:
- an unexpected text or email contains a refund link;
- the sender threatens immediate arrest, account closure or loss of the refund;
- a website address misspells the agency name or uses an unfamiliar commercial domain;
- you are asked to pay a fee, buy gift cards, use cryptocurrency or send a wire;
- the message promises a larger refund or a secret credit;
- someone requests remote access to your device;
- a social-media account sends a direct message claiming to be a tax agency.
The IRS tax scam page notes that unexpected pressure, threats, promises and demands for personal or financial information are common warning signs.
How to check whether a letter is genuine
A paper letter is safer than an unsolicited link, but fake letters exist. Do not use a QR code or phone number until you have checked it independently.
- Note the agency name, letter or notice number, tax year and response deadline.
- Type the state tax agency’s known address into your browser or use our state directory.
- Look up the notice number on the agency website if it offers a notice library.
- Call the published agency number and ask whether the notice and reference number are connected to your account.
- Respond using the agency portal you reached independently or the verified mailing address.
A genuine letter should not require gift cards, cryptocurrency or payment to release a refund. Do not post a photo of the letter online; barcodes and reference numbers may reveal account information.
What a legitimate verification may require
Requirements vary, but you may need:
- the letter or notice;
- a government-issued photo ID;
- the return named in the letter;
- a prior-year return;
- wage or income documents;
- answers about information only the filer should know.
Use a private device and trusted network. Do not complete verification while screen-sharing with a caller. If an online process does not work, use the alternative phone or in-person method in the verified agency instructions.
What if you did not file the return?
Tell the agency immediately through its official channel. A notice about a return you did not file can mean someone used your identity. Do not verify the fraudulent return as yours simply to see what happens.
The FTC’s tax identity theft guidance directs victims to IdentityTheft.gov for a recovery plan. For federal tax identity theft, follow the IRS procedure in the letter and its identity-theft guidance. Consider these broader protective steps:
- secure email and tax-software accounts with unique passwords and multifactor authentication;
- review credit reports and financial accounts;
- preserve the fraudulent message or letter as evidence;
- report exposed identifying information at IdentityTheft.gov;
- ask the IRS about an Identity Protection PIN for future federal returns;
- contact the state tax agency if state tax information may also be affected.
What if you clicked but did not submit anything?
Close the page. Do not download files or call numbers displayed there. If you entered a password, change it immediately from the real service and anywhere else it was reused. Enable multifactor authentication. Scan the device using its trusted security tools if you downloaded or installed anything.
If you entered an SSN, bank details or tax information, treat it as an identity-theft exposure even if no money has disappeared. Contact your bank when financial details were involved and follow IdentityTheft.gov’s tailored steps.
Suspicious IRS-related emails and websites can be forwarded to phishing@irs.gov; unwanted texts can be forwarded to 7726, according to FTC guidance. Report consumer fraud at ReportFraud.ftc.gov.
Can verification delay a legitimate refund?
Yes. The purpose is to prevent payment until the filer is confirmed. Responding completely through the verified method is usually the fastest path. Sending partial documents, using the wrong portal or skipping the return-verification questions can leave the case unresolved.
After you respond, keep the confirmation and allow the agency’s stated post-verification time. The general original-return estimate may no longer apply. Do not file another return while the verified one is pending unless the agency instructs you to do so.
How to check a refund safely from the start
- Begin at a bookmarked agency site or our state refund directory.
- Inspect the full website address before entering an SSN or ITIN.
- Keep your return private and nearby.
- Use your own device on a trusted connection.
- Close the government page when finished.
- Never give tax identifiers to this site—or any directory, blog or person who contacts you unexpectedly.
The goal is not to fear every agency request. It is to separate a real request from a convincing imitation before sharing the information that protects your refund.
